@prefecthq/fastmcp-ts 0.0.2-alpha.0 → 0.0.4

package/dist/client.d.ts

@@ -1,8 +1,8 @@
-import { CreateMessageResult, CreateMessageResultWithTools, ContentBlock, CreateMessageRequestParams, LoggingLevel, ElicitRequestParams, ElicitResult, Tool, Resource, Prompt, ResourceTemplate, ResourceContents, GetPromptResult, Root, ModelPreferences, SamplingMessage, ToolChoice } from '@modelcontextprotocol/sdk/types';
-export { ContentBlock, CreateMessageRequestParams, CreateMessageResult, CreateMessageResultWithTools, ElicitRequestParams, ElicitResult, GetPromptResult, LoggingLevel, ModelPreferences, Prompt, PromptArgument, PromptMessage, Resource, ResourceContents, ResourceTemplate, Root, SamplingMessage, Tool, ToolChoice, ToolResultContent, ToolUseContent } from '@modelcontextprotocol/sdk/types';
+import { CreateMessageResult, CreateMessageResultWithTools, ContentBlock, CreateMessageRequestParams, LoggingLevel, ElicitRequestParams, ElicitResult, Tool, Resource, Prompt, ResourceTemplate, TextResourceContents, BlobResourceContents, GetPromptResult, Root, ModelPreferences, SamplingMessage, ToolChoice } from '@modelcontextprotocol/sdk/types.js';
+export { BlobResourceContents, ContentBlock, CreateMessageRequestParams, CreateMessageResult, CreateMessageResultWithTools, ElicitRequestParams, ElicitResult, GetPromptResult, LoggingLevel, ModelPreferences, Prompt, PromptArgument, PromptMessage, Resource, ResourceContents, ResourceTemplate, Root, SamplingMessage, TextResourceContents, Tool, ToolChoice, ToolResultContent, ToolUseContent } from '@modelcontextprotocol/sdk/types.js';
 import { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import { Transport } from '@modelcontextprotocol/sdk/shared/transport';
+import { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI from 'openai';
 import { GoogleGenAI } from '@google/genai';
@@ -75,7 +75,7 @@ interface IToolsClient {
 interface IResourcesClient {
     listResources(options?: RequestOptions): Promise<Resource[]>;
     listResourceTemplates(options?: RequestOptions): Promise<ResourceTemplate[]>;
-    readResource(uri: string, options?: RequestOptions): Promise<ResourceContents[]>;
+    readResource(uri: string, options?: RequestOptions): Promise<Array<TextResourceContents | BlobResourceContents>>;
     subscribeResource(uri: string, handler: ResourceUpdateHandler, options?: RequestOptions): Promise<void>;
     unsubscribeResource(uri: string, options?: RequestOptions): Promise<void>;
 }
@@ -126,8 +126,10 @@ declare class InMemoryStore implements KeyValueStore {
     delete(key: string): Promise<void>;
 }
 declare class FileTokenStorage implements KeyValueStore {
-    private readonly _path;
+    private readonly _explicitPath?;
+    private _resolvedPath?;
     constructor(path?: string);
+    private _path;
     private _readAll;
     private _writeAll;
     get(key: string): Promise<string | null>;
@@ -167,9 +169,9 @@ declare class OAuth implements OAuthClientProvider {
     private readonly _callbackPort;
     private readonly _onRedirect?;
     private _codeVerifier;
-    private _callbackPromise;
-    private _callbackResolve;
-    private _callbackReject;
+    protected _callbackPromise: Promise<string> | null;
+    protected _callbackResolve: ((code: string) => void) | null;
+    protected _callbackReject: ((err: Error) => void) | null;
     private _callbackServer;
     private _actualCallbackPort;
     constructor(options?: OAuthOptions);
@@ -185,6 +187,20 @@ declare class OAuth implements OAuthClientProvider {
     tokens(): Promise<OAuthTokens | undefined>;
     saveTokens(tokens: OAuthTokens): Promise<void>;
     redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    /**
+     * Creates the pending-callback promise that {@link waitForCallback} awaits.
+     * Subclasses (e.g. BrowserOAuth) call this before opening their own redirect.
+     */
+    protected _armCallbackPromise(): void;
+    /** Resolves the pending callback with an authorization code. */
+    protected _resolveCallback(code: string): void;
+    /** Rejects the pending callback with an error. */
+    protected _rejectCallback(err: Error): void;
+    /**
+     * Races the pending callback promise against a timeout and clears the
+     * promise state. Subclasses reuse this and add their own teardown.
+     */
+    protected _awaitCallback(timeoutMs: number): Promise<string>;
     saveCodeVerifier(codeVerifier: string): void;
     codeVerifier(): string;
     invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
@@ -236,6 +252,80 @@ declare class ClientCredentials {
     private _doFetch;
 }
 
+/**
+ * KeyValueStore backed by `localStorage`. Synchronous and simple; suitable for
+ * OAuth tokens and client registration state in single-page apps. Keys are
+ * namespaced by a prefix to avoid collisions with other app state.
+ */
+declare class LocalStorageStore implements KeyValueStore {
+    private readonly _prefix;
+    constructor(prefix?: string);
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/**
+ * KeyValueStore backed by IndexedDB. Preferred when tokens should survive
+ * outside the synchronous, size-limited localStorage (e.g. larger payloads or
+ * stricter persistence). Opens the database per operation and closes it again.
+ */
+declare class IndexedDBStore implements KeyValueStore {
+    private readonly _dbName;
+    private readonly _storeName;
+    constructor(opts?: {
+        dbName?: string;
+        storeName?: string;
+    });
+    private _open;
+    private _tx;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+
+interface BrowserOAuthOptions extends Omit<OAuthOptions, 'callbackPort' | 'onRedirect'> {
+    /**
+     * Redirect URI registered with the provider. Must serve a page that calls
+     * {@link handleOAuthCallback} (popup mode) or is your app route that reads the
+     * returned `?code=` (redirect mode).
+     */
+    redirectUri: string;
+    /**
+     * 'popup' (default) opens the authorization URL in a popup window and listens
+     * for a postMessage from the callback page. 'redirect' navigates the whole
+     * tab; resume with {@link BrowserOAuth.resumeFromRedirect} on return.
+     */
+    mode?: 'popup' | 'redirect';
+    /** `window.open` features string for popup mode. */
+    popupFeatures?: string;
+}
+declare class BrowserOAuth extends OAuth {
+    private readonly _redirectUri;
+    private readonly _mode;
+    private readonly _popupFeatures;
+    private _popup;
+    private _messageHandler;
+    constructor(options: BrowserOAuthOptions);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    waitForCallback(timeoutMs?: number): Promise<string>;
+    /**
+     * Redirect-mode resume: parse the authorization code from a returned URL
+     * (defaults to the current location). Returns the code, or null if absent.
+     * Throws if the provider returned an error.
+     */
+    resumeFromRedirect(href?: string): string | null;
+    private _teardown;
+}
+/**
+ * Call from the redirect_uri page (popup mode) to deliver the authorization
+ * code back to the opener window and close the popup.
+ */
+declare function handleOAuthCallback(opts?: {
+    targetOrigin?: string;
+}): void;
+
 interface McpServerLike {
     connect(transport: Transport): Promise<void>;
 }
@@ -296,7 +386,7 @@ declare class MultiServerClient implements IClient {
     callToolRaw<TData = unknown>(name: string, args?: Record<string, unknown>, options?: CallToolOptions): Promise<CallToolResult<TData>>;
     listResources(options?: RequestOptions): Promise<Resource[]>;
     listResourceTemplates(options?: RequestOptions): Promise<ResourceTemplate[]>;
-    readResource(uri: string, options?: RequestOptions): Promise<ResourceContents[]>;
+    readResource(uri: string, options?: RequestOptions): Promise<Array<TextResourceContents | BlobResourceContents>>;
     listPrompts(options?: RequestOptions): Promise<Prompt[]>;
     getPrompt(name: string, args?: Record<string, string>, options?: RequestOptions): Promise<GetPromptResult>;
     subscribeResource(uri: string, handler: ResourceUpdateHandler, options?: RequestOptions): Promise<void>;
@@ -397,7 +487,7 @@ declare class Client implements IClient {
     callToolRaw<TData = unknown>(name: string, args?: Record<string, unknown>, options?: CallToolOptions): Promise<CallToolResult<TData>>;
     listResources(options?: RequestOptions): Promise<Resource[]>;
     listResourceTemplates(options?: RequestOptions): Promise<ResourceTemplate[]>;
-    readResource(uri: string, options?: RequestOptions): Promise<ResourceContents[]>;
+    readResource(uri: string, options?: RequestOptions): Promise<Array<TextResourceContents | BlobResourceContents>>;
     /** Returns the raw SDK ReadResourceResult without unwrapping. */
     readResourceRaw(uri: string, options?: RequestOptions): Promise<{
         [x: string]: unknown;
@@ -540,4 +630,4 @@ declare class GoogleSamplingAdapter implements SamplingAdapter {
     asHandler(): SamplingHandler;
 }
 
-export { AnthropicSamplingAdapter, type AnySamplingResult, BearerAuth, type CallToolOptions, type CallToolResult, Client, ClientCredentials, type ClientCredentialsOptions, type ClientDefaultOptions, type ClientHandlers, type ClientOptions, type ClientTransportInput, type CompletionResult, type ElicitationHandler, FileTokenStorage, type GenericCompletionFn, type GenericCompletionParams, GenericSamplingAdapter, GoogleSamplingAdapter, type IClient, type IPromptsClient, type IResourcesClient, type IToolsClient, InMemoryStore, type KeyValueStore, type ListChangedHandler, type LogHandler, type LogMessage, type McpConfig, type McpServerEntry, type McpServerLike, type McpServerValue, type ModelSelector, MultiServerClient, type MultiServerOptions, OAuth, type OAuthOptions, type OAuthToken, type OnTokenCallback, OpenAISamplingAdapter, type ProgressHandler, type RequestOptions, type ResourceUpdateHandler, type Result, type RootInput, type RootsValue, type SamplingAdapter, type SamplingAdapterOptions, type SamplingHandler, StdioTransport, ToolCallError, defaultLogHandler, defaultProgressHandler, toResult };
+export { AnthropicSamplingAdapter, type AnySamplingResult, BearerAuth, BrowserOAuth, type BrowserOAuthOptions, type CallToolOptions, type CallToolResult, Client, ClientCredentials, type ClientCredentialsOptions, type ClientDefaultOptions, type ClientHandlers, type ClientOptions, type ClientTransportInput, type CompletionResult, type ElicitationHandler, FileTokenStorage, type GenericCompletionFn, type GenericCompletionParams, GenericSamplingAdapter, GoogleSamplingAdapter, type IClient, type IPromptsClient, type IResourcesClient, type IToolsClient, InMemoryStore, IndexedDBStore, type KeyValueStore, type ListChangedHandler, LocalStorageStore, type LogHandler, type LogMessage, type McpConfig, type McpServerEntry, type McpServerLike, type McpServerValue, type ModelSelector, MultiServerClient, type MultiServerOptions, OAuth, type OAuthOptions, type OAuthToken, type OnTokenCallback, OpenAISamplingAdapter, type ProgressHandler, type RequestOptions, type ResourceUpdateHandler, type Result, type RootInput, type RootsValue, type SamplingAdapter, type SamplingAdapterOptions, type SamplingHandler, StdioTransport, ToolCallError, defaultLogHandler, defaultProgressHandler, handleOAuthCallback, toResult };

package/dist/client.js

@@ -25,11 +25,6 @@ function defaultProgressHandler(progress, total, message) {
 }
 
 // src/client/auth.ts
-import { spawn } from "child_process";
-import * as fs from "fs/promises";
-import * as http from "http";
-import { homedir } from "os";
-import { dirname, join } from "path";
 var InMemoryStore = class {
   _map = /* @__PURE__ */ new Map();
   async get(key) {
@@ -43,13 +38,22 @@ var InMemoryStore = class {
   }
 };
 var FileTokenStorage = class {
-  _path;
+  _explicitPath;
+  _resolvedPath;
   constructor(path) {
-    this._path = path ?? join(homedir(), ".fastmcp", "tokens.json");
+    this._explicitPath = path;
+  }
+  async _path() {
+    if (this._resolvedPath) return this._resolvedPath;
+    if (this._explicitPath) return this._resolvedPath = this._explicitPath;
+    const { homedir } = await import("os");
+    const { join } = await import("path");
+    return this._resolvedPath = join(homedir(), ".fastmcp", "tokens.json");
   }
   async _readAll() {
+    const fs = await import("fs/promises");
     try {
-      const raw = await fs.readFile(this._path, "utf8");
+      const raw = await fs.readFile(await this._path(), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         return parsed;
@@ -60,10 +64,13 @@ var FileTokenStorage = class {
     }
   }
   async _writeAll(data) {
-    await fs.mkdir(dirname(this._path), { recursive: true });
-    const tmp = `${this._path}.tmp`;
+    const fs = await import("fs/promises");
+    const { dirname } = await import("path");
+    const path = await this._path();
+    await fs.mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
     await fs.writeFile(tmp, JSON.stringify(data, null, 2), "utf8");
-    await fs.rename(tmp, this._path);
+    await fs.rename(tmp, path);
   }
   async get(key) {
     const data = await this._readAll();
@@ -152,17 +159,54 @@ var OAuth = class {
     await this._store.set(this._key("tokens"), JSON.stringify(tokens));
   }
   async redirectToAuthorization(authorizationUrl) {
-    this._callbackPromise = new Promise((resolve2, reject) => {
-      this._callbackResolve = resolve2;
-      this._callbackReject = reject;
-    });
-    this._callbackPromise.catch(() => {
-    });
+    this._armCallbackPromise();
     await this._startCallbackServer();
     if (this._onRedirect) {
       await this._onRedirect(authorizationUrl);
     } else {
-      openBrowser(authorizationUrl.toString());
+      await openBrowser(authorizationUrl.toString());
+    }
+  }
+  /**
+   * Creates the pending-callback promise that {@link waitForCallback} awaits.
+   * Subclasses (e.g. BrowserOAuth) call this before opening their own redirect.
+   */
+  _armCallbackPromise() {
+    this._callbackPromise = new Promise((resolve, reject) => {
+      this._callbackResolve = resolve;
+      this._callbackReject = reject;
+    });
+    this._callbackPromise.catch(() => {
+    });
+  }
+  /** Resolves the pending callback with an authorization code. */
+  _resolveCallback(code) {
+    this._callbackResolve?.(code);
+  }
+  /** Rejects the pending callback with an error. */
+  _rejectCallback(err) {
+    this._callbackReject?.(err);
+  }
+  /**
+   * Races the pending callback promise against a timeout and clears the
+   * promise state. Subclasses reuse this and add their own teardown.
+   */
+  async _awaitCallback(timeoutMs) {
+    if (!this._callbackPromise) {
+      throw new Error("No pending OAuth callback \u2014 call redirectToAuthorization() first");
+    }
+    const timeout = new Promise(
+      (_, reject) => setTimeout(
+        () => reject(new Error("OAuth callback timed out waiting for authorization")),
+        timeoutMs
+      )
+    );
+    try {
+      return await Promise.race([this._callbackPromise, timeout]);
+    } finally {
+      this._callbackPromise = null;
+      this._callbackResolve = null;
+      this._callbackReject = null;
     }
   }
   saveCodeVerifier(codeVerifier) {
@@ -211,30 +255,19 @@ var OAuth = class {
    * Must be called after the UnauthorizedError thrown by connect() is caught.
    */
   async waitForCallback(timeoutMs = 5 * 60 * 1e3) {
-    if (!this._callbackPromise) {
-      throw new Error("No pending OAuth callback \u2014 call redirectToAuthorization() first");
-    }
-    const timeout = new Promise(
-      (_, reject) => setTimeout(
-        () => reject(new Error("OAuth callback timed out waiting for authorization")),
-        timeoutMs
-      )
-    );
     try {
-      return await Promise.race([this._callbackPromise, timeout]);
+      return await this._awaitCallback(timeoutMs);
     } finally {
-      this._callbackPromise = null;
-      this._callbackResolve = null;
-      this._callbackReject = null;
       this._stopCallbackServer();
     }
   }
   _key(type) {
     return `${this._serverUrl}/${type}`;
   }
-  _startCallbackServer() {
-    if (this._callbackServer) return Promise.resolve();
-    return new Promise((resolve2, reject) => {
+  async _startCallbackServer() {
+    if (this._callbackServer) return;
+    const http = await import("http");
+    await new Promise((resolve, reject) => {
       const server = http.createServer((req, res) => {
         const url = new URL(req.url ?? "/", `http://localhost`);
         const error = url.searchParams.get("error");
@@ -266,7 +299,7 @@ var OAuth = class {
           this._actualCallbackPort = addr.port;
         }
         this._callbackServer = server;
-        resolve2();
+        resolve();
       });
     });
   }
@@ -367,7 +400,8 @@ var ClientCredentials = class {
     return this._fetchPromise;
   }
 };
-function openBrowser(url) {
+async function openBrowser(url) {
+  const { spawn } = await import("child_process");
   if (process.platform === "win32") {
     spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" });
   } else if (process.platform === "darwin") {
@@ -377,12 +411,153 @@ function openBrowser(url) {
   }
 }
 
+// src/client/browser-stores.ts
+var LocalStorageStore = class {
+  _prefix;
+  constructor(prefix = "fastmcp:") {
+    this._prefix = prefix;
+  }
+  async get(key) {
+    return localStorage.getItem(this._prefix + key);
+  }
+  async set(key, value) {
+    localStorage.setItem(this._prefix + key, value);
+  }
+  async delete(key) {
+    localStorage.removeItem(this._prefix + key);
+  }
+};
+var IndexedDBStore = class {
+  _dbName;
+  _storeName;
+  constructor(opts = {}) {
+    this._dbName = opts.dbName ?? "fastmcp";
+    this._storeName = opts.storeName ?? "auth";
+  }
+  _open() {
+    return new Promise((resolve, reject) => {
+      const req = indexedDB.open(this._dbName, 1);
+      req.onupgradeneeded = () => {
+        if (!req.result.objectStoreNames.contains(this._storeName)) {
+          req.result.createObjectStore(this._storeName);
+        }
+      };
+      req.onsuccess = () => resolve(req.result);
+      req.onerror = () => reject(req.error ?? new Error("indexedDB.open failed"));
+    });
+  }
+  async _tx(mode, fn) {
+    const db = await this._open();
+    try {
+      return await new Promise((resolve, reject) => {
+        const req = fn(db.transaction(this._storeName, mode).objectStore(this._storeName));
+        req.onsuccess = () => resolve(req.result);
+        req.onerror = () => reject(req.error ?? new Error("indexedDB request failed"));
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async get(key) {
+    const value = await this._tx("readonly", (s) => s.get(key));
+    return value ?? null;
+  }
+  async set(key, value) {
+    await this._tx("readwrite", (s) => s.put(value, key));
+  }
+  async delete(key) {
+    await this._tx("readwrite", (s) => s.delete(key));
+  }
+};
+
+// src/client/browser-oauth.ts
+var MESSAGE_TYPE = "fastmcp:oauth";
+var BrowserOAuth = class extends OAuth {
+  _redirectUri;
+  _mode;
+  _popupFeatures;
+  _popup = null;
+  _messageHandler = null;
+  constructor(options) {
+    super(options);
+    this._redirectUri = options.redirectUri;
+    this._mode = options.mode ?? "popup";
+    this._popupFeatures = options.popupFeatures ?? "width=600,height=720";
+  }
+  get redirectUrl() {
+    return this._redirectUri;
+  }
+  get clientMetadata() {
+    return { ...super.clientMetadata, redirect_uris: [this._redirectUri] };
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    if (this._mode === "redirect") {
+      window.location.assign(authorizationUrl.toString());
+      return;
+    }
+    const expectedOrigin = new URL(this._redirectUri).origin;
+    this._messageHandler = (e) => {
+      if (e.origin !== expectedOrigin) return;
+      const data = e.data;
+      if (data?.type !== MESSAGE_TYPE) return;
+      if (data.error) this._rejectCallback(new Error(`OAuth authorization denied: ${data.error}`));
+      else if (data.code) this._resolveCallback(data.code);
+    };
+    window.addEventListener("message", this._messageHandler);
+    this._armCallbackPromise();
+    this._popup = window.open(authorizationUrl.toString(), "fastmcp-oauth", this._popupFeatures);
+    if (!this._popup) {
+      this._teardown();
+      throw new Error(
+        'Failed to open OAuth popup \u2014 it was likely blocked. Trigger connect from a user gesture or use mode: "redirect".'
+      );
+    }
+  }
+  async waitForCallback(timeoutMs = 5 * 60 * 1e3) {
+    try {
+      return await this._awaitCallback(timeoutMs);
+    } finally {
+      this._teardown();
+    }
+  }
+  /**
+   * Redirect-mode resume: parse the authorization code from a returned URL
+   * (defaults to the current location). Returns the code, or null if absent.
+   * Throws if the provider returned an error.
+   */
+  resumeFromRedirect(href = window.location.href) {
+    const params = new URL(href).searchParams;
+    const error = params.get("error_description") ?? params.get("error");
+    if (error) throw new Error(`OAuth authorization denied: ${error}`);
+    return params.get("code");
+  }
+  _teardown() {
+    if (this._messageHandler) window.removeEventListener("message", this._messageHandler);
+    this._messageHandler = null;
+    try {
+      this._popup?.close();
+    } catch {
+    }
+    this._popup = null;
+  }
+};
+function handleOAuthCallback(opts = {}) {
+  const params = new URLSearchParams(window.location.search);
+  const code = params.get("code") ?? void 0;
+  const error = params.get("error_description") ?? params.get("error") ?? void 0;
+  const target = opts.targetOrigin ?? window.location.origin;
+  window.opener?.postMessage({ type: MESSAGE_TYPE, code, error }, target);
+  window.close();
+}
+
 // src/client/transports.ts
-import { normalizeHeaders } from "@modelcontextprotocol/sdk/shared/transport";
-import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+async function createStdioTransport(opts) {
+  const { StdioClientTransport } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+  return new StdioClientTransport(opts);
+}
 function isMcpServerLike(value) {
   return typeof value === "object" && value !== null && "connect" in value && typeof value.connect === "function";
 }
@@ -401,6 +576,12 @@ var StdioTransport = class {
     this.cwd = options?.cwd;
   }
 };
+function normalizeHeaders(headers) {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  if (Array.isArray(headers)) return Object.fromEntries(headers);
+  return { ...headers };
+}
 function isAsyncAuth(auth) {
   return "kind" in auth;
 }
@@ -455,7 +636,7 @@ function urlToTransport(url, auth, extraHeaders = {}) {
     ...customFetch ? { fetch: customFetch } : {}
   });
 }
-function resolveEntryTransport(entry, auth) {
+async function resolveEntryTransport(entry, auth) {
   if (isMcpServerLike(entry)) {
     const [serverSide, clientSide] = InMemoryTransport.createLinkedPair();
     return {
@@ -471,7 +652,7 @@ function resolveEntryTransport(entry, auth) {
   }
   const cmd = entry;
   return {
-    transport: new StdioClientTransport({
+    transport: await createStdioTransport({
       command: cmd.command,
       args: cmd.args,
       env: cmd.env
@@ -483,10 +664,10 @@ function resolveEntryAuth(auth) {
   if (typeof auth === "string") return new BearerAuth(auth);
   return auth;
 }
-function resolveTransport(input, auth) {
+async function resolveTransport(input, auth) {
   if (input instanceof StdioTransport) {
     return {
-      transport: new StdioClientTransport({
+      transport: await createStdioTransport({
         command: input.command,
         args: input.args,
         env: input.env,
@@ -505,7 +686,7 @@ function resolveTransport(input, auth) {
     const entries = Object.entries(input.mcpServers);
     if (entries.length === 0) throw new Error("mcpServers config is empty");
     const [, entry] = entries[0];
-    return resolveEntryTransport(entry, auth);
+    return await resolveEntryTransport(entry, auth);
   }
   if (isMcpServerLike(input)) {
     const [serverSide, clientSide] = InMemoryTransport.createLinkedPair();
@@ -520,8 +701,6 @@ function resolveTransport(input, auth) {
 }
 
 // src/client/client.ts
-import { resolve } from "path";
-import { pathToFileURL } from "url";
 import { Client as SdkClient2 } from "@modelcontextprotocol/sdk/client";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import {
@@ -531,7 +710,7 @@ import {
   ListRootsRequestSchema as ListRootsRequestSchema2,
   LoggingMessageNotificationSchema as LoggingMessageNotificationSchema2,
   ResourceUpdatedNotificationSchema as ResourceUpdatedNotificationSchema2
-} from "@modelcontextprotocol/sdk/types";
+} from "@modelcontextprotocol/sdk/types.js";
 
 // src/client/multi-server.ts
 import { Client as SdkClient } from "@modelcontextprotocol/sdk/client";
@@ -542,7 +721,7 @@ import {
   CreateMessageRequestSchema,
   ElicitRequestSchema,
   ListRootsRequestSchema
-} from "@modelcontextprotocol/sdk/types";
+} from "@modelcontextprotocol/sdk/types.js";
 var MultiServerClient = class _MultiServerClient {
   _clients = /* @__PURE__ */ new Map();
   _connectPromise = null;
@@ -588,7 +767,7 @@ var MultiServerClient = class _MultiServerClient {
         entries.map(async ([name, entry]) => {
           const sdk = this._buildSdkClient();
           this._registerHandlers(sdk);
-          const { transport, beforeConnect } = resolveEntryTransport(
+          const { transport, beforeConnect } = await resolveEntryTransport(
             entry
           );
           if (beforeConnect) await beforeConnect();
@@ -1020,7 +1199,7 @@ var Client = class _Client {
       }
     );
     this._registerHandlers(sdkClient);
-    const { transport, beforeConnect } = resolveTransport(this._input, this._auth);
+    const { transport, beforeConnect } = await resolveTransport(this._input, this._auth);
     if (this._auth instanceof OAuth) {
       const serverUrl = this._extractServerUrl();
       if (serverUrl) this._auth._bind(serverUrl);
@@ -1036,7 +1215,9 @@ var Client = class _Client {
             code
           );
         }
-        await sdkClient.connect(transport);
+        const retry = await resolveTransport(this._input, this._auth);
+        if (retry.beforeConnect) await retry.beforeConnect();
+        await sdkClient.connect(retry.transport);
       } else {
         throw err;
       }
@@ -1295,17 +1476,23 @@ function resolveAuth(auth) {
 }
 function normalizeRootsOption(roots) {
   if (typeof roots === "function") {
-    return async () => (await roots()).map(normalizeRootInput);
+    return async () => Promise.all((await roots()).map(normalizeRootInput));
   }
-  const normalized = roots.map(normalizeRootInput);
-  return () => Promise.resolve(normalized);
+  return async () => Promise.all(roots.map(normalizeRootInput));
 }
-function normalizeRootInput(input) {
-  if (typeof input === "string") return { uri: normalizeRootUri(input) };
-  return { ...input, uri: normalizeRootUri(input.uri) };
+async function normalizeRootInput(input) {
+  if (typeof input === "string") return { uri: await normalizeRootUri(input) };
+  return { ...input, uri: await normalizeRootUri(input.uri) };
 }
-function normalizeRootUri(input) {
-  if (input.startsWith("file://")) return input;
+async function normalizeRootUri(input) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(input)) return input;
+  if (typeof process === "undefined" || !process.versions?.node) {
+    throw new Error(
+      `Cannot normalize filesystem root "${input}" in a browser. Pass a file:// URI instead.`
+    );
+  }
+  const { resolve } = await import("path");
+  const { pathToFileURL } = await import("url");
   return pathToFileURL(resolve(input)).href;
 }
 
@@ -1740,12 +1927,15 @@ var GoogleSamplingAdapter = class {
 export {
   AnthropicSamplingAdapter,
   BearerAuth,
+  BrowserOAuth,
   Client,
   ClientCredentials,
   FileTokenStorage,
   GenericSamplingAdapter,
   GoogleSamplingAdapter,
   InMemoryStore,
+  IndexedDBStore,
+  LocalStorageStore,
   MultiServerClient,
   OAuth,
   OpenAISamplingAdapter,
@@ -1753,6 +1943,7 @@ export {
   ToolCallError,
   defaultLogHandler,
   defaultProgressHandler,
+  handleOAuthCallback,
   toResult
 };
 //# sourceMappingURL=client.js.map